For Providers and Government

For service providers and government

On Record should complement—not duplicate—HMIS, coordinated entry, Shelter Ready, or case-management systems. The public layer is not a place to upload client records, publish bed counts, or assign a provider score.

Minimum operating expectations

• Use individual accounts, role-based/attribute-based access, MFA, least privilege, confidentiality agreements, training, offboarding, encryption, and append-only audit logs.
• Keep identity, health, victim-service, recovery, and case data in protected systems.
• Route structured offers through moderation; do not expose a person to open comment threads.
• Use neutral response events and give the requester a correction/appeal path.
• Label freshness, eligibility, capacity, and provenance; never imply a placement guarantee.
• Publish a plain-language notice, retention schedule, complaint route, incident plan, and accessibility options before intake.

HMIS and sensitive providers

Any connector requires a data-sharing agreement, permitted-use matrix, current HUD/CoC mapping, legal and privacy review, synthetic tests, rollback, and a named owner. Victim-service providers may require a separate workflow under VAWA/FVPSA or other confidentiality rules. If the boundary cannot be documented, do not integrate.

Accountability without punishment

Show acknowledged, deferred, referred, scheduled, completed, declined, expired, and withdrawn events with context. Do not infer moral failure from non-response. Let providers correct records, but do not let them unilaterally declare a requester’s need resolved.